Full Report
Cybercriminals are selling forged identity documents, deepfake videos, and live verification services to help buyers bypass Know Your Client (KYC) checks. Flare examines how these underground services operate and the techniques used to create and maintain fraudulent verified accounts. [...]
Analysis Summary
# Tool/Technique: Underground Know Your Client (KYC) Bypass Services
## Overview
The article describes an underground market that sells tools and services for defeating KYC identity verification at financial institutions and cryptocurrency exchanges. Offerings include forged identity documents (passports, driver's licenses, Social Security cards), edited financial records such as bank statements, deepfake photos and videos, live verification assistance, and pre-verified accounts. The article uses the February 2026 guilty plea of the OnlyFake operator as a reference point. That service generated more than 10,000 fraudulent digital identity documents, according to the U.S. Department of Justice. Flare observed the activity between March and September 2026.
## Technical Details
- **Type:** Technique and service ecosystem (identity fraud-as-a-service). No specific malware family is described.
- **Platform:** Not applicable. Targets are KYC workflows at banks, cryptocurrency exchanges, and other regulated platforms, including their document-verification, facial-comparison, and liveness-check systems.
- **Capabilities (as described):**
- Generation of forged identity documents in multiple formats and countries, with a choice of scan or photograph appearance
- Generated or edited supporting financial documents tailored to a specific platform's verification requirements
- Manipulated photographs and videos, including deepfakes
- Live verification assistance by human operators or synthetic media
- Sale of accounts that claim to have already passed identity checks
- **First Seen:** OnlyFake activity referenced in the article; the operator pleaded guilty in February 2026. Underground offerings observed March–September 2026.
## MITRE ATT&CK Mapping
*These mappings are analyst inferences. The article does not provide ATT&CK mappings.*
- **TA0043 - Reconnaissance**
- T1589 - Gather Victim Identity Information (collection of personal data used to build identity packages)
- **TA0042 - Resource Development**
- T1585 - Establish Accounts (creation of accounts on target platforms using fabricated identities)
- T1586 - Compromise Accounts (sale and use of accounts that already passed verification)
- T1588 - Obtain Capabilities (purchase of forged documents and deepfake media)
- **TA0005 - Defense Evasion**
- T1656 - Impersonation (presenting a false identity to pass verification)
- **TA0001 - Initial Access / TA0003 - Persistence**
- T1078 - Valid Accounts (use of verified accounts for access or fraud)
## Functionality
### Core Capabilities
- Sellers produce identity documents tailored to individual verification requests.
- Sellers produce supporting records (bank statements and similar) that platforms use to confirm address, income, or account ownership.
- Sellers keep names, photographs, addresses, and other details consistent across the package, since mismatches trigger rejection or review.
- Sellers offer pre-verified accounts for purchase.
### Advanced Features
- Packages are adapted to the specific requirements of each target platform.
- Operators provide live verification help, including synthetic media used against liveness checks.
- The article describes a five-stage workflow: identity data, documents, photos or videos, device and browser preparation to look like a legitimate customer, and live verification.
## Indicators of Compromise
- **File Hashes:** None provided in the article.
- **File Names:** None provided.
- **Registry Keys:** Not applicable.
- **Network Indicators:** None. The only domains cited (flare.io, justice.gov, bleepingcomputer.com) are references, not malicious infrastructure.
- **Behavioral Indicators:** The article does not describe technical behaviors. For defenders, watch for applications with inconsistent identity attributes across submissions, multiple accounts sharing devices or browser fingerprints, and verification sessions that show signs of synthetic media.
## Associated Threat Actors
- The OnlyFake operator, who pleaded guilty in the United States in February 2026.
- Unnamed forum sellers in underground communities. The article does not name specific groups.
## Detection Methods
- **Signature-based:** Not applicable in the traditional sense. Document-forgery and deepfake detection tools can flag known generator artifacts.
- **Behavioral:**
- Cross-check identity attributes (names, addresses, photos) across applications and accounts for reuse or inconsistency.
- Flag device, browser, and session fingerprints that recur across multiple identities.
- Apply transaction monitoring and re-verification when account activity or stated information changes, as KYC requires.
- **YARA rules:** None provided.
## Mitigation Strategies
- **Prevention:**
- Layer document verification, biometric comparison, and liveness detection, and do not rely on a single check.
- Use injection-attack and deepfake detection in video verification.
- Verify source-of-funds and address claims against independent data sources.
- **Hardening:**
- Monitor for account takeover and for sold or shared account credentials.
- Re-verify accounts periodically and after suspicious changes.
- Share indicators of fraud with industry peers and follow regulatory guidance such as FATF digital identity guidance.
## Related Tools/Techniques
- OnlyFake fraudulent document service (the subject of the February 2026 DOJ case)
- Synthetic identity fraud
- Deepfake-based biometric spoofing
- Account takeover and purchase of verified accounts
---
**Note on the source:** The article is a sponsored piece from Flare, a threat intelligence vendor, and it promotes its platform. The provided text is also truncated before the sections on liveness bypass techniques, so details on those methods are not summarized here.